What did you see instead?

Other Notes

On line 137 of vgo/vendor/cmd/go/internal/vgo/fetch.go, for len(data) > 0 { doesn't account for the fact that echo >go.modverify creates a single byte file while touch go.modverify creates a 0 byte file, yet the documentation at Reproducible, Verifiable, Verified Builds shows the echo >go.modverify usage.

While the short term solution would be to change the documentation to touch go.modverify, as evidenced by the usage in the documentation, the echo >[file] usage is common for creating a blank file, and if this is done, the byte length check will err out.